Google wants users to enable an account setting to block out the new attack.